#525: Overall review of features which enable/disable subframe or subresource capabilities
Discussions
2020-06-22
Tess: we're worried about script isolation... iframes... Take a step back and make a holistic review.
[Tess & David
2020-07-20
David: smaller breakout with Tess required?
Yves: I sent mail to webappsec working group to ask if they were interested in helping but have not heard anything back.
Peter: schedule breakout time for tomorrow?
David: Will try sometime this week
2020-08-17
Tess: This is a big chunk of work. Ideally we can come up with a table of all features, APIs and what their behavior is in terms of capabilities inherited by parent browsing context etc. ... I will schedule time for myself and Rossen to work on this tomorrow.
2021-01-Kronos
Rossen: I think Tess and I had a spreadsheet.... did we ever find it? We spent an hour building it in a breakout at some point.
(pinged Tess and got a link to the spreadsheet).
2023-04-tokyo
Discussion about the conceptual overlap between these feature controls and the Spectre/Meltdown mitigations, wondering if the same task force that looks at CO* headers should look at these controls. Ideally maybe a common control layer can be created for authors to enable features that also mitigates Spectre/Meltdown under a layer of abstraction.
2024-01-london
we discuss closing this since we haven't made progress
Lea: could it be a principle?
Tess: we are the right group to do this --
Sangwhan: it would take an entire f2f...
Dan: topic for TAG future?
Sangwhan: We have to go through all that's currently available - requires a focussed issue.
Tess: 468 is also similar.....
OpenedJun 15, 2020
We're concerned with the large number of features used to constrain/grant access to capabilities in subframes/subresources. The large number of related, yet distinct knobs, and the different kind of knobs, makes it challenging for authors to do the right thing.
We hope that a review of all of these mechanisms may identify areas where simplification or consolidation could occur while still enabling all necessary use cases. We also hope this review will result in related changes to the Web Platform Design Principles document, to help spec authors in the future when they consider adding yet another feature in this area.
This came up during our review of #397. Possibly-related older reviews include